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We describe efficient protocols for quantum oblivious transfer and for 
one-out-of-two quantum oblivious transfer. These protocols, which can be 
implemented with present technology, are secure against general attacks as 
long as the cheater can not store the bit for an arbitrarily long period of 
time. 
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In 1970, Wiesner M wrote a highly innovative paper about quantum cryp- 
tography 0, 0. In his paper, he also introduced the concept of Multiplexing, 
which was later rediscovered by Rabin, Q and is now usually called Oblivious 
Transfer (OT). Let us briefly describe the OT protocol: 

1 - Alice knows one bit A, where A is either 1 or —1 ||. 

2 - Bob obtains bit A from Alice with probability 0.5. 

3 - Bob knows whether or not he obtained bit A. 

4 - Alice does not learn whether or not Bob obtained bit A. 

In this letter, we propose a very efficient protocol for quantum oblivi- 
ous transfer which is secure even against cheaters with unlimited computing 
power, if we assume that Bob can not store the bit for an arbitrarily long 
period of time. It is worth noting that none of the known non-quantum pro- 
tocols for oblivious transfer are perfectly secure; they all allow one among 
Alice or Bob to cheat without risk of detection if he or she can break some 
unproved cryptographic assumptions. 

Before proceeding, it is useful to review some elementary features of quan- 
tum mechanics. We consider an unstable source emitting pairs of entangled 
Einstein, Podolsky, Rosen (EPR) || particles. We take the z axis along the 
direction of the flight of the particles, and the x and the y axes along any 
two directions perpendicular to the z axis. For a pair of particles in the EPR 
state | = j- 2 (|TT)+ |U», the expected value of the product of the spin 

of the particles along two arbitrary axes a and b in the xy plane is p| 

{(j>\a a 1 a b 2 \0) = cos(9 a + 9 h ), (1) 

where o\ is the spin of the first particle along axis a, a\ is the spin of the 
second particle along axis b, and 9 a (9b) is the angle between axis a (bj and the 
Thus the spin of the first particle along the x axis, mf, is perfectly 
correlated with the spin of the second particle along the same axis, i.e., 
m\m\ = 1. However, the spin of the first particle along the y axis is perfectly 
anticorrelated with the spin of the second particle along the same axis, i.e, 
m\m% — — 1. Similarly for EPR states |TD| 
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(a' | o a x o\ | a') = - sin (9 a + 6 b ) , 

(J3\ot<4\/3)=sm(9 a -9 b ), 
((3'\a a 1 a b 2 \(3') = - S m(6 a -e b ). 

With the above in mind, we now proceed to describe the following pro- 
tocol: 

(1) Alice and Bob agree that the bit A is encoded in the product of the spin 
of the first and the second particles along the x axis (m x m 2 or — mfmf), 
or the spin of the first and the second particles along the y axis (m\m\' or 
—m{m v 2 ), or the spin of the first particle along the y axis and the spin of 
the second particle along the x axis (mfmf or — mfm^), or the spin of the 
first particle along the and the spin of the second particle along 
the y axis ( m^rn^ or — m^mf). They also agree on a set A defined as 
A = {mfmf , m\m\ r \ ) and on a set B defined as B = {m\m%, m^m^}. 

(2) Alice encodes the bit to be obliviously transferred in m\m 2 , or — mfm%, 
or m\m\, or —mfrn^, or mfm^, or — mfmf, or mi x m\, or —rn^rn^, cho- 
sen randomly by her. She randomly chooses an appropriate state (as shown 
below, there are two appropriate states for any of her choices). She then 
prepares a pair of particles in that state and sends both particles to Bob. 

(3) Bob measures randomly either m\m\ or mfml, or mfmf , or rni x m v 2 . 

(4) Alice asks Bob if his measurements have been successful. If he says no, 
then she goes to step 2. If he says yes, then she considers the following two 
cases: 

(/) Alice asks Bob if his measurement belongs to set A. If he says no, then 
she goes to (II). If he says yes (but of course he does not tell her along which 
axes he performed his measurements), and if she has chosen one of the four 
state | a), or | a'), or | (3), or | /?'), then she tells him that the protocol has 
not been successful, and she goes to step (2). But if she has chosen one of 
the four states | 0), or | (/)'), or | ip), or | ifj'), then she tells him only one of the 
following four alternatives: 

(i) X is encoded in mfm^, 

(ii) A is encoded in — m^m^, 
(in) A is encoded in mfm^, 
(iv) A is encoded in — mfm^. 

(//) Alice asks Bob if his measurement belongs to set B. If he says yes, and 
if she has chosen one of the four state | 0), or | 0'), or | or | -0'), then she 
tells him the protocol has not been successful, and she goes to step (2). But 
if she has chosen one of the four states | a), or | a'), or | (3), or | /?'), then she 
tells him only one of the following four alternatives: 
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(i) A is encoded in rn\m% , 
(m) A is encoded in — mfmf , 
(m) A is encoded in mj^mj}, 
(iv) A is encoded in — m^mf. 

Theorem: Assuming that Bob can not store the bit until step 4 (when 
Alice asks him whether his measurement belongs to set A or B), the above 
oblivious transfer protocol is secure even against cheater with unlimited com- 
puting power. 

Proof. First we consider Alice's strategy. We assume that Alice has cho- 
sen one of the four state | 0), or | 0'), or | ip), or | tp'), and Bob's measurement 
belongs to set A, i.e., he has measured rafmf or m\m 2 . Alice should consider 
the following four cases: 

(1) First assume A = 1(— 1), and Alice decides to encode A in m\m^ (— mfm%). 
In this case, Alice should choose either | 0) or \ip), since for both of these 
states mfraf = 1- If Bob measures the spin of the two particles along the 
x-axis, then he learns the value of A. However, if he measures the spins of 
the particles along the y-axis, then he does not learn any information about 
A, since (0 \ o\a\ \ 0) = —1, but {tp \ o\o\ \ ip) — 1. 

(2) Next assume A = —1(1), and Alice decides to encode A in mfmf (— mfraf). 
In this case, Alice should choose either | 0') or | ip'), since for both of these 
states mfm% — — 1. If Bob measures the spin of the two particles along the 
x-axis, then he learns the value of A. However, if he measures the spins of 
the particles along the y-axis, then he does not learn any information about 
A, since (0' | a\o\ | 0') = 1, but | of of \ = -1. 

(3) Next assume A = 1(— 1), and Alice decides to encode A in mfml (— mfm^). 
In this case, Alice should choose either | 0') or | ■0), since for both of these 
states nil m 2 = 1 If Bob measures the spin of both particles along the y-axis, 
then he learns the value of A. However, if he measures the spins of the par- 
ticles along the x-axis, then does not learn any information about the value 
of A, since (0' | erf erf | 0') = —1, but | a^a^ \ ip) — 1. 

(4) Finally assume A = —1(1), and Alice decides to encode A in mfm^ (— mfrnf) 
In this case, Alice should choose either | 0) or | ip'), since for both of these 
states m\m\ = — 1 If Bob measures the spin of both particles along the y- 
axis, then he learns the value of A. However, if he measures the spins of the 
particles along the x-axis, then does not learn any information about the 
value of A, since (0 | of erf | 0) = 1, but (-0' | crfa% | ip') = —1. 

We now consider Bob's strategy. If Bob is honest, then the oblivious 
transfer protocol can succeed without any difficulty (see above). Consider 
now a cheating Bob who measures the spin of the first particle along axis 
a and measures the spin of the second particle along axis b, i.e., m\m b 2 . 
Assume (without loss of generality) that Bob obtains m\rr^ 2 = 1. Bob then 
asks the following question: Given that mjm^ = 1, what is the probability 
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that mfm 2 = 1, i.e., what is p (mfm% = 1 | m\rr^ 2 = ljl To answer this 
question, he notes that only states | <f>) and | ip) can contribute to m^m 2 = 1. 



Thus 



p (m\m x 2 = 1 | m\m\ = l) = p (| 0) | m?m£ = l) + p (| ip) \ m\m\ = l) . (3) 
To calculate p (| </>) \ m\rr^ 2 = lj, note that 



p (| 4>) , m\m\ = l) = p {\4>)) p (m a 1 m b 2 = l\ | <; 

= jo (mjm^ = l) p | m^m^ = l) . (4) 

But 

p{\m = \ (5) 

p (m\m\ = l) = i, (6) 

p (m\m\ = \\ 10)) = cos 2 (^±^, (7) 

where (5) follows from the fact that Alice chooses any state with probability 
^, (6) follows from the symmetry of the problem, and (7) follows from the 
standard rules of quantum mechanics. 
Substituting the above formulas in Eq. (4), we obtain 



p (|0)|mX = l) = ^cos 2 ^^J. (8) 
Similar argument shows that 



p | m\m\ = l) = icos 2 ^ 



da — &b 



(9) 



Thus 



P 



(mfmf = 1 | m\m\ = 1) = - cos 2 I — J + ^ cos 2 I — g— J • (10) 



Bob now asks the following question: Given that m^m 2 = 1, what is the 
probability that mfml = 1, i.e., what is p (mfml = 1 | m1m 2 = 1)? To 
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answer this question, he notes that only states | 0') and | ip) can contribute 
to mfm| = 1. Thus 



p (m\m\ = 1 | m\m\ = l) = p (| 0') | m\m\ = l) + p (| V) | K™2 = l) -(H) 
Similar argument as before shows that 



\m\ = 1 | m\m\ = l) = ^ sin 2 P4^M + ± cos 2 p_^> (12) 




Now the probability that Bob learns the value of A is ^ [ V {rn^vrv^ = 1 | 
m1m b 2 = 1) +p (m x m 2 = 1 | m\m b 2 = 1) ]. From Eqs. (12) and (14), we have 
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p {m\m y 2 = 1 | m\m? 2 = lj + p [m\m x 2 = 1 | m a L rn b 2 = 1) 




(13) 



Note that the maximum value of the RHS of (13) is ^. Thus the best 
strategy for Bob is to measure the spins of both particles either along the 
same axis. In particular, if Bob does not cheat and measures the spins of 
both particles either along the x-axis or along the y-axis, then he obtains 
maximum information about the value of the OT bit A. 

Having demonstrated that if Alice chooses one of the four states | 0), 
or | 0'), or | -0), or | ip'), and if Bob's measurement belongs to set A, then 
the OT protocol can be implemented successfully, we now consider the other 
alternative. We assume that Alice has chosen one of the four state | a), or 
| a'), or | /?), or | /?'), and Bob's measurement belongs to set B, i.e., he has 
measured mfmf , or rn^vrv^. Again Alice should consider the following four 
cases: 

(1) First assume A = 1(— 1), and Alice encodes A in m\m 2 (—m\m 2 ). In this 
case, Alice should choose either | a) or | (3), since for both of these states 
m\m 2 = 1. If Bob measures the spin of the first particle along the y axis, 
and spin of the second particle along the x axis, then he learns the value of 
A. However, if he measures the spins of the first particle along the —x axis, 
and the spin of the second particle along y axis, then he does not learn any 
information about A, since (a \ crf'Vf | a) = —1, but ((3 \ erf 11 erf | P) — 1. 

(2) Next assume A = —1(1), and Alice encodes A in m\m 2 (—mim 2 ). In this 
case, Alice should choose either | a') or | (3'), since for both of these states 
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mfmf = — 1. If Bob measures the spin of the first particle along the y axis, 
and spin of the second particle along the x axis, then he learns the value of 
A. However, if he measures the spins of the first particle along the 
and the spin of the second particle along y axis, then he does not learn any 
information about A, since (a' | of 31 of \ a') — 1, but (/?' | o^ x a\ | (3') = —1. 

(3) Next assume A = 1(— 1), and Alice encodes A in m^rn^ (—m^m^J. In 
this case, Alice should choose either | a'} or | /?), since for both of these 
states mj^ ml = 1 If Bob measures the spin of the first particle along -x axis 
and spin of the second particle along the y-axis, then he learns the value 
of A. However, if he measures the spin of of the first particle along the y 
axis and spin of the second particle along the x axis, then he does not learn 
any information about the value of A, since (a' | of erf | a') = —1, but 
((3 | of of | /?) = 1. 

(4) Finally assume A = —1(1), and Alice encodes A in mf^m^ (^—m^rrv^j. 
In this case, Alice should choose either | a) or | /?'), since for both of these 
states m^rrv^ = — 1 If Bob measures the spin of both particles along the 
l/-axis, then he learns the value of A. However, if he measures the spin of of 
the first particle along the y axis and spin of the second particle along the 
X clXIS, then he does not learn any information about the value of A, since 
(a | of of | a) = -1, but (/?' | of of | /?') = 1. 

If Bob is honest, then the OT protocol can succeed without any difficulty 
(see above). However, if Bob is dishonest, the same argument as before shows 
that he does not gain any additional information by cheating. Thus the OT 
protocol is secure even against cheaters with unlimited computing power. 

There is another flavor of OT which is called one-out-of-two oblivious 
transfer. The goal of this protocol is: 

1 - Alice has two bits Ai and A 2 where Ai (or A 2 ) is either 1 or —1. 

2 - Bob chooses to obtain either bit Ai or A 2 . 

3 - Bob knows whether or not he has obtained the bit. 

4 - Alice does not learn which bit Bob has chosen. 

Less formally, Alice has two bits. Bob can get only one of them, and Alice 
does not learn which bit Bob obtained. 
This protocol can be implemented by 

(1) Alice and Bob agree that Ai is encoded in m^m^, or — m^m^, or m^mf, 
or — mfm^, and A 2 is encoded in mfm^, or — mfm^, or mi x m v 2 , or —m^vrv^. 
They also agree on a set A defined as A = {mjmf , mim 2 }, and on a set B 
defined as B = {m^m^.m^mQ. 

(2) Alice encodes Ai in mfmf, or — mfmf, or mfmf, or — m^mf , and A 2 in 
m\m2, or — mfm 2 , or m^ml, or — m^m^, chosen randomly by her. She 
randomly chooses an appropriate state (as shown below, there are two ap- 
propriate states for any of her choices). She then prepares a pair of particles 
in that state and sends both particles to Bob. 
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(3) Bob measures randomly either mfmf or mfm^, or m\m% , or m^rn^. 

(4) Alice asks Bob if his measurements have been successful. If he says no, 
then she goes to step 2. If he says yes, then she considers the following two 
cases: 

(I) Alice asks Bob if his measurement belongs to set A. If he says no, then 
Alice goes to step (II). If he says yes (but of course he does not tell her along 
which axes he performed his measurements), and if she has chosen one of the 
four state \a), or | a'), or | f3), or | j3 f ), then she tells him that the protocol 
has not been successful, and she goes to step (2). But if Alice has chosen 
one of the four states | 0), or | 0'), or | or | ip'), then she tells him that Ai 
is encoded in mfmf or —mfmf, and A 2 is encoded in mfml or — mim 2 . 

(II) Alice asks Bob if his measurement belongs to set B. If he says yes, and 
if she has chosen one of the four state | 0), or | 0'), or | -0), or | tp'), then she 
tells him that the protocol has not been successful, and she goes to step (2). 
But if Alice has chosen one of the four states | a), or | a'), or | (3), or | (3'), 
then she tells him that Ai is encoded in mfmf or — mfrnf , and A 2 is encoded 
in mi x m v 2 or —m^ml- 

Theorem: Assuming that Bob can not store the bit until step 4 (when 
Alice asks him whether his measurement belongs to set A or B), the above 
one-out-of-two oblivious transfer protocol is secure against cheater with un- 
limited computing power. 

Proof. First Assume that Bob performed his measurement in set A, and 
Alice has chosen one of the four states | 0), or | 0'), or | ip), or | ip'), (similar 
argument also applies if Alice has chosen one of the four states | a) , or | a') , 
or \(3) 1 or \(3')). She should consider the following four cases: 

(i) First assume Ai = 1, A 2 = 1, and Alice decides to encode Ai in mfmf, 
and A 2 in mfm 2 , or Ai = — 1, A 2 = — 1, and Alice decides to encode Ai in 
—mfmf, and A 2 in — mfm 2 In this case, Alice should choose state \ since 
for this state mfmf = 1, and mfm 2 = 1. 

(ii) Next assume Ai = 1, A 2 = — 1, and Alice decides to encode Ai in mfmf, 
and A 2 in mfm 2 , or Ai = —1, A 2 = 1, and Alice decides to encode Ai in 
—mfmf, and A 2 in — mfm 2 . In this case, Alice should choose state | 0), since 
for this state mfmf = 1, and mfm 2 = — 1. 

(Hi) Next assume Ai = — 1, A 2 = 1, and Alice decides to encode Ai in mfmf, 
and A 2 in mfm 2 , or Ai = 1, A 2 = —1, and Alice decides to encode Ai in 
—mfmf, and A 2 in — mfm 2 . In this case, Alice should choose state | 0'), 
since for this state mfmf = —1, and mfm 2 = 1. 

(iv) Finally assume Ai = —1, A 2 = —1, and Alice decides to encode Ai in 
mfmf, and A 2 in mfm 2 , or Ai = 1, A 2 = 1, and Alice decides to encode Ai 
in —mfmf, and A 2 in — mfm 2 . In this case, Alice should choose state | ip'), 
since for this state mfmf = —1, and mfm| = —1. 

The same argument that was used for quantum OT can be used to prove 
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that Bob does not gain any additional information by setting his polarizer 
at other angles. Thus the one-out-of-two OT protocol is secure even against 
cheaters with unlimited computing power. 
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